<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-mailStijl17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi Everybody,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are trying to release a new scoped attribute from one of our federations’ IdPs. To this end we added the following<o:p></o:p></p>
<p class="MsoNormal">code to the IdPs attribute-resolver.xml:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""><resolver:AttributeDefinition id="NewAttribute" xsi:type="Scoped" xmlns="urn:mace:shibboleth:2.0:resolver:ad"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> scope="kuleuven.be" sourceAttributeID="SourceAttribute"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <resolver:Dependency ref="myLDAP" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <resolver:AttributeEncoder xsi:type="SAML1ScopedString" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> name="urn:mace:dir:attribute-def:NewAttribute" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <resolver:AttributeEncoder xsi:type="SAML2ScopedString" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> name="urn:mace:kuleuven.be:dir:attribute-def:NewAttribute" friendlyName="NewAttribute" /><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL-BE" style="font-family:"Courier New","serif""></resolver:AttributeDefinition><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL-BE" style="font-family:"Courier New","serif""><o:p> </o:p></span></p>
<p class="MsoNormal">We also updated the attribute-filter.xml to release the attribute, and added a line to the metadata to enable this IdP to use the ‘kuleuven.be’ scope:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""><EntityDescriptor entityID="IdPEntityID"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:36.0pt"><span style="font-family:"Courier New","serif""><IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt;text-indent:36.0pt"><span style="font-family:"Courier New","serif""><Extensions><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt;text-indent:36.0pt"><span style="font-family:"Courier New","serif""><shibmd:Scope regexp="false">otherscope</shibmd:Scope><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:72.0pt;text-indent:36.0pt"><span style="font-family:"Courier New","serif""><shibmd:Scope regexp="false">kuleuven.be</shibmd:Scope><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt;text-indent:36.0pt"><span style="font-family:"Courier New","serif""></Extensions><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> …<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the IdPs side, everything seems ok, the IdP release the attribute correctly as we have confirmed by<o:p></o:p></p>
<p class="MsoNormal">inspecting the logs.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Next we configured a test SP to receive this new attribute. Adding a rule to the attribute-policy.xml:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""><afp:PermitValueRule id="ScopingRules" xsi:type="AND"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <Rule xsi:type="NOT"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <Rule xsi:type="AttributeValueRegex" regex="@"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> </Rule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope" xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""></afp:PermitValueRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""><afp:AttributeRule attributeID="NewAttribute"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""> <afp:PermitValueRuleReference ref="ScopingRules"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""></afp:AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""><o:p> </o:p></span></p>
<p class="MsoNormal">Now according to the SP logs, the attribute is successfully received. The problem is that it is filtered out by the SPs filtering policy:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif"">2013-02-20 11:19:16 DEBUG Shibboleth.AttributeFilter [3]: applying filtering rule(s) for attribute (NewAttribute) from (IdPEntityID)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif"">2013-02-20 11:19:16 WARN Shibboleth.AttributeFilter [3]: removed value at position (0) of attribute (NewAttribute) from (IdPEntityID)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New","serif""><o:p> </o:p></span></p>
<p class="MsoNormal">It seems the scope is not properly applied. When I change the SPs filter to only allow values containing an ‘@’, the attribute passes just fine. We are releasing other attributes that are scoped with<o:p></o:p></p>
<p class="MsoNormal">the ‘otherscope’ defined in our attribute-filter.xml, and these are also passing the SPs filter without a problem. I can’t find a difference between the old attributes that work and the new attribute that doesn’t
<o:p></o:p></p>
<p class="MsoNormal">anywhere…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Can anyone spot any obvious errors here, or tell me other places I could look for configuration mistakes?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
<p class="MsoNormal">Joep<o:p></o:p></p>
</div>
</body>
</html>